1

I have a C# project that I want to modify with dnlib. Modifying it with dnspy, I can add the code in just fine. However, I was not able to find a way to add the DLLImport in with dnlib, and all searches came up dry. How can I pull this off? Can it even be done?

EDIT: I dug through dnSpy's source and found a way. I am puttin' it here so that everyone can see it:

var _loadedEXE = ModuleDefMD.Load("EXE.exe");
var _dllReference = new ModuleRefUser(_loadedEXE, "DLL_NAME.dll");

var _flagsDLL = MethodAttributes.PinvokeImpl | MethodAttributes.Public | MethodAttributes.Static;
var _flagsPDLL = MethodImplAttributes.PreserveSig;

var _mapDLL = new ImplMapUser(_dllReference, "", PInvokeAttributes.CallConvCdecl);
            
var _method = new MethodDefUser("METHOD_NAME", MethodSig.CreateStatic(_loadedEXE.CorLibTypes.Int32, _loadedEXE.CorLibTypes.Int32), _flagsPDLL, _flagsDLL);
_method.ImplMap = _mapDLL;

This will result in the following decomp from dnSpy:

[DllImport("DLL_NAME.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern int METHOD_NAME(int);

I hope this will be helpful to you so you do not suffer as I have.

  • *I was not able to find a way to add the DLLImport in with dnlib* - this can mean many things, e.g: you added it but it did not work, you simply could not save your adding, it did not work with some error thrown ... So plz add more details about it. Sharing what you've experimented is helpful to the community as well even when the question does not have any answers. – King King Apr 04 '21 at 06:17
  • I have looked through all the documentation and all the code but could not see a way to PInvoke, basically. I do not know how I can be more specific. – Topaz M. Whitelock Apr 04 '21 at 06:34

1 Answers1

0

Implementing VirtualProtect with dnlib

[DllImport("kernel32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.Winapi)]
internal static extern bool VirtualProtect(IntPtr address, IntPtr size, uint newProtect, out uint oldProtect);
var virtualProtectNativeMethodAttributes = MethodAttributes.PinvokeImpl | MethodAttributes.Assembly | MethodAttributes.Static;
var virtualProtectNativeMethodImplementationAttributes = MethodImplAttributes.PreserveSig;

var dllReference = new ModuleRefUser(moduleDefMD, "kernel32.dll");
var nativeMethodName = "VirtualProtect";
var implementationMap = new ImplMapUser(dllReference, nativeMethodName, PInvokeAttributes.CharSetAuto | PInvokeAttributes.CallConvWinapi);

var virtualProtectNativeMethod = new MethodDefUser(nativeMethodName,
    MethodSig.CreateStatic(moduleDefMD.CorLibTypes.Boolean, moduleDefMD.CorLibTypes.IntPtr, moduleDefMD.CorLibTypes.IntPtr, moduleDefMD.CorLibTypes.UInt32, moduleDefMD.CorLibTypes.UInt32),
    virtualProtectNativeMethodImplementationAttributes, virtualProtectNativeMethodAttributes);

virtualProtectNativeMethod.ImplMap = implementationMap;
virtualProtectNativeMethod.ParamDefs.Add(new ParamDefUser("address", 1));
virtualProtectNativeMethod.ParamDefs.Add(new ParamDefUser("size", 2));
virtualProtectNativeMethod.ParamDefs.Add(new ParamDefUser("newProtect", 3));
virtualProtectNativeMethod.ParamDefs.Add(new ParamDefUser("oldProtect", 4, ParamAttributes.Out));
sunnamed
  • 96
  • 1
  • 10
  • Please provide detail and clarity of code – Pradeep Kumar Oct 27 '22 at 09:54
  • @PradeepKumar wdym? Add summaries in code? Everything is easy in this code, idk what you didnt understand here, this is a basic signature of method (in this case this is a method without body that has single attribute called DllImport, this is the same code as asked and showed in this thread upper, but a bit fixed, simply working version). – sunnamed Oct 28 '22 at 17:49
  • please add at least comments in what you have changed or what code does. – Pradeep Kumar Oct 28 '22 at 17:54
  • @PradeepKumar those who want can figure it out for themselves, there is nothing not-understandable or hard here, I have added a few lines of code that adding ParamDefs to the native method, and fixed creating of MethodSig by actually creating it and making static, that`s all – sunnamed Oct 28 '22 at 18:02